Creates strong passwords in your browser. Pick a type below, then press Generate. Passwords stay in this tab unless you export them.
Security Warnings:
Settings
Balanced security for most online accounts. Good mix of complexity and usability.
Maximum security with 20+ characters, all character types, and no dictionary words.
Strong but memorable. Email accounts are prime targets for attackers.
Compliance-focused with common corporate policy requirements.
Easy to share verbally while maintaining good security.
Maximum entropy with special attention to SQL injection prevention.
Manual settings below. Use this for specific requirements.
The only feature that uses the network. Your password is not sent — only the first 5 characters of its hash.
Your browser hashes the password locally (SHA-1) and sends only the first 5 characters of that hash to the Have I Been Pwned Pwned Passwords API. That prefix is shared by many thousands of different passwords, so it does not identify yours. This is called k‑anonymity.
HIBP returns every hash ending that starts with those 5 characters, and your browser does the matching. The password itself and the full hash never leave this device.
Untick the box above and the app makes no network requests at all while you use it — generating, analysing, QR codes, speech and history are all local.
One thing does load from elsewhere: the page requests its display font from Google Fonts when it opens. That happens once, before you type anything, and carries no password data. Everything else, including the QR code library, is served from this site.